About the software side first:
Yes, absolutely wipe the disks.
It will defeat most malware (because most are simply not sophisticated enough to remain somewhere else ), ti helps the privacy of the previous owner, saves you some possible legal troubles because of software licenses and/or confidential data, etc.
Anf of course, you have clean and fast system, instead of all additional garbage that collected with long-term computer usage before; with the settings and softwares of your choice only.
About the "how" - it should go without saying that wiping is not deleting files in Windows. However partitioning and/or dd from /dev/zero isn't enough anymore either.
With eg. an Linux USB (or any other system capable of this) first wipe both disks eg. with dd from /dev/zero, and then for the SSD also run a "secure erase" eg. with hdparm. Because due to wear levelling etc., the dd only isn't enough there. Since it is a laptop (often without SATA hotplug capabilites) and many buggy USB connectors, it might be a bit tricky, but nonetheless recommended.
And the hardware ...
It depends who you want to protect against.
- The previous owner who was an average computer user?
- State-level actors, HW vendors, and technical people capable of actually writing BIOS malware etc., who might have done something while (or before) the previous owner was using the computer?
For the first:
- Per definition above, these people are not capable of doing much. Maybe able to buy a keylogger in the internet, but else...
- Yes, flash the BIOS. Not so much because of malware, but just to have an update.
- Make sure that, if you have Intel ME/AMT, that it is at least disabled completely. If you don't need it, I'd recommend using me_cleaner to get rid of it as much as possible. (In case you dont know what ME is, this "feature" allows full remote control of the computer, even when turned off (but with power). Of course the intended usage is that unauthorized people get no access. However the previous owner might have configured access for himself, and furhtermore there are several known security bugs).
- If you want, open the computer and identify what each part is for. Eg. a small black box plugged in between keyboard and mainboard might save your typed passwords and probably shouldn't be there...
For the other group: If you think they might have done something with this computer (and something they don't do to all computers in your country etc.), then do not use it.
Even with all technical knowledge of the world, searching "something" they could have done would be searching a needle in a haystack. It isn't worth the effort. And of course we don't have "all" knowledge either.
Jus to address the BIOS / mainboard firmware: Updating it per software is useless against malware in it, because updating requires the cooperation of the mainboard (of course). If there exists some malware already, it just could say "ok, update finished" without actually replacing the infected parts.
As the relevant data usually is in a distinct device on the mainboard, changing it with proper hardware is better (as the turned-off mainboard can't prevent it). However, even if you find someone to do that, it's just one of very many possible attack vectors, so...
Related example: Devices like hard disks, network cards and CPUs have their own firmware. What about these? Right, you would have to replace them too (because of this cases, the next computer repair shop too has no tools anymore to force in clean data). And then you can replace everything and end up with a new computer.
